Fingerprinting refers to creating a unique signature for a browser -- whether on a PC or mobile device -- that allows a tracking firm to watch which sites a user visits, no matter which device they're using. "Fingerprinting user devices through the browser is an increasingly common practice used of advertising and anti-fraud companies," according to the researchers.

But it's a practice that may exist in a legal gray area. "Stateless user tracking allows advertising companies to sidestep the limitations imposed by regulation on cookies in Europe and the United States," according to the researchers. "Moreover, with the advent of smartphones and tablets, fingerprinting allows advertisers to augment previously gathered user data and track the user across devices."

The researchers said their discovery of 16 new fingerprinting scripts and Flash objects, as well as counts of the sites using the technology, demonstrates "that fingerprinting is much more prevalent than previous studies estimated." Furthermore, while the total number of sites -- just 404 -- on which they found the JavaScript tracking technology might seem small, they cautioned that their Web crawling targeted only homepages, and couldn't penetrate paywalls or any site with a Turing test.

The JavaScript-based fingerprinting technology is being sold or distributed by tracking firm BlueCava, Bitcoin digital wallet provider CoinBase, geolocation and "online fraud prevention" firm MaxMind, and consumer tracking provider Mindshare Technology, among other companies. Some of those fingerprint scripts appeared to actively try to evade detection by deleting themselves as soon as they'd run and relayed a fingerprint to a third-party server.

BlueCava's font-probing JavaScript code was the most prevalent such script detected by the researchers, and ran on the homepages of 250 sites that are included in the Alexa index of the 1 million most popular websites. "[BlueCava's] is the only one of the discovered font-probing scripts that queries different sets of fonts based on the device's operating system: 231 fonts for Microsoft Windows, 167 for Mac OS and 62 for other operating systems," said the researchers.

The researchers also looked for Flash-based fingerprinting technology, although only on the world's 10,000 most popular websites as ranked by Alexa, and detected the technology in use on 95 of those sites.

Cookie-free tracking technologies -- often referred to as supercookies -- are typically designed to avoid detection as well as users' attempts to block the technology. Likewise, the technology historically hasn't ever been deterred by the presence of an active "do not track" flag in a user's browser. Many privacy advocates have long held that the only way to stop the cookies will be through legislation that requires websites to disclose the tracking technology they're using, as well as to respect people's DNT preferences.

Might an anonymizing browser, such as Tor, help block the latest generation of supercookies? While that would theoretically help a user defeat the tracking mechanisms, in fact Tor doesn't restrict the browser's ability to call system fonts, meaning Tor users' devices can still be fingerprinted using the font-probing techniques. But the researchers said they've alerted Tor to the vulnerability, and that it's been fixed in the forthcoming source code and version 2.4 of the Tor browser bundle.

Going forward, the researchers said they plan to release the source code for the tool they developed to crawl the Web in search of fingerprinting technology, which they dubbed FPDetective. They built it using modified versions of the PhantomJS "headless" Webkit browser, as well as the Chrome browser. FPDetective includes the ability to relay Flash files through "an SSL-capable intercepting proxy," which allowed the researchers to capture, decompile and analyze the font-probing Flash files using third-party tools.

First, this type of personal information is a commodity -- it can be bought and sold (for profit). The more information, the more valuable the record associated with a given person.

Second, it gives advertisers "richer" insights into individual consumers (i.e. you and me). Visit a website that's concerned with menopause, pregnancy, erectile disfunction, baseball or divorce -- and the advertiser's algorithms can spot that and serve up more targeted (and thus theoretically likely to get clicked on and converted to a sale) advertising. And every click or completed sale equals revenue for the advertiser and commissions for affiliates.

The "benefit" for consumers, or hit to our privacy? That's open to debate.

I remember the do-not-track debate from my time working at a direct & digital marketing trade publication. This report makes it seem that the debate has shifted more to a steroids-in-baseball-style arms race, with one side racing to stay ahead of the rules. The New York Times has some recent reporting on the subject as well, so it's clearly in the public consciousness GÇö I wonder (if we ever have a functioning government again) if some legislation to codify what's appropriate is coming.

Published: 2015-03-03Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

Published: 2015-03-03** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none.

How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.